Search & browse the archive

IAPP · May 20, 2026 · International

AI such as Mythos Preview raises the urgency of cross-border flows of cybersecurity data

Advanced AI systems like Mythos Preview are intensifying debates around the cross-border transfer of cybersecurity data, as the capabilities of such tools depend on access to threat intelligence that routinely moves across national boundaries. The development draws renewed attention to how existing data localization rules and transfer frameworks handle security-sensitive information.

Who should care: General readers · AI governance · Policy

FTC Consumer Protection · May 19, 2026 · US Federal

FTC Begins Enforcing the TAKE IT DOWN Act

The FTC has begun enforcing the TAKE IT DOWN Act, which compels online platforms to remove nonconsensual intimate imagery upon victim request. The agency launched a dedicated complaint portal where affected individuals can report platforms that fail to establish or honor removal procedures.

Who should care: Lawyers · Privacy officers · Compliance · General readers · Policy

OECD AI Policy Observatory · May 19, 2026 · International

The European Union is deploying AI across strategic sectors

The European Union is integrating AI systems into healthcare, manufacturing, transportation, and agriculture, framing the initiative around the concept of 'trustworthy AI' as a means to strengthen economic competitiveness across member states.

Who should care: AI governance · Lawyers · Administrators · General readers · Policy

War on the Rocks · May 19, 2026 · International

When Refusal Doesn’t Matter: Operation Epic Fury and the Erosion of Host Nation Consent

When the U.S. military launched its war against Iran in Feb. 2026, it did not just dismantle Iranian military capabilities. It shattered the illusion that the United States would consult with its closest allies and that an ally’s refusal to grant base access can stop an American war in motion. Rather than the much discussed “outward flows” of military assets from the Korean Peninsula to the Middle East, it is the anticipated “inward flows” of U.S. military assets that could be more consequential in times of crisis.Focusing on the early days of the fallout of this…

Who should care: General readers · Privacy officers · Policy

Krebs on Security · May 18, 2026 · International

CISA Admin Leaked AWS GovCloud Keys on Github

A contractor working for CISA left highly privileged AWS GovCloud credentials and internal system details exposed in a public GitHub repository until this past weekend. Security experts described the leaked archive, which included details about how the agency builds and deploys its own software, as one of the most serious government data exposures in recent memory.

Who should care: Cybersecurity · Privacy officers · Administrators

IAPP · May 15, 2026 · International

Notes from the IAPP Canada: Special report on CRA breaches raises fresh privacy concerns

A special report discussed at IAPP Canada has renewed scrutiny over privacy breaches at the Canada Revenue Agency, drawing attention to how sensitive taxpayer data has been compromised. The report surfaces ongoing concerns about the CRA's ability to protect the personal and financial information it holds on virtually every Canadian adult.

Who should care: General readers · Privacy officers · Policy

Information Commissioner's Office · May 14, 2026 · UK

Five steps to protect your organisation from AI-powered cyber threats

The UK's Information Commissioner's Office has published guidance outlining five steps organisations can take to defend against cyber threats that are being amplified or enabled by artificial intelligence. The guidance is aimed at helping organisations strengthen their security posture as AI tools become more accessible to bad actors.

Who should care: General readers · AI governance · Policy

IAPP · May 14, 2026 · International

King's Speech signals diffuse UK digital policy agenda, but no AI bill

I need more content from the excerpt to work with, but based on the headline alone — that the UK's King's Speech outlined a broad digital policy agenda while notably omitting any dedicated AI legislation — I can write an accurate, grounded briefing. ```json { "summary": "The UK government's King'

Who should care: General readers · AI governance · Policy

IAPP · May 14, 2026 · International

Notes from the Asia-Pacific region: Malaysia tightens data protection expectations with trio of guides

Malaysia's data protection authority has released three new guidance documents aimed at raising compliance expectations for organizations handling personal data. The guides signal a more structured regulatory posture from Malaysian authorities on data protection obligations.

Who should care: General readers · Privacy officers · Policy

Privacy Commissioner of Canada · May 14, 2026 · Canada

Letter to the Standing Committee on Access to Information, Privacy and Ethics on the Main Estimates for the Office of the Privacy Commissioner of Canada for 2026-2027

The Office of the Privacy Commissioner of Canada submitted a letter to Parliament's ethics and privacy committee outlining its budget request for the 2026-2027 fiscal year. The submission is part of the standard Main Estimates process through which federal oversight bodies request funding from Parliament.

Who should care: General readers · Privacy officers · Policy

Privacy Commissioner of Canada · May 14, 2026 · Canada

Letter to the Standing Committee on Procedure and House Affairs on the privacy implications of Bill C-25

I need to reason carefully here. The headline and excerpt are identical and minimal — they tell me a letter was sent to a Canadian parliamentary committee about the privacy implications of Bill C-25. Bill C-25 relates to Canadian electoral or parliamentary procedure (the Standing Committee on Proced

Who should care: General readers · Privacy officers · Policy

FTC Consumer Protection · May 13, 2026 · US Federal

Shutterstock to Pay $35 Million to Settle FTC Allegations Over Illegal Subscription and Cancellation Practices

Shutterstock has agreed to pay $35 million to settle FTC allegations that it charged consumers without clear consent and deliberately made subscriptions hard to cancel. The agency found the platform engaged in a range of deceptive billing practices that generated tens of millions of dollars from affected customers.

Who should care: General readers · Privacy officers · Policy

IAPP · May 13, 2026 · International

Companies pair up to release Automated AI Governance Package

Two companies have jointly launched an automated AI governance package, targeting organizations seeking structured tools to manage compliance and oversight of artificial intelligence systems. The product appears aimed at streamlining governance workflows, though specific technical details and partner identities were not disclosed in the announcement.

Who should care: AI governance · Lawyers · Administrators · General readers · Policy

IAPP · May 13, 2026 · International

From privacy policies to machine-readable governance: Rethinking data control in the age of AI

A piece published through the IAPP examines the limitations of traditional privacy policies as a governance tool and makes the case for machine-readable formats that AI systems can interpret and enforce directly, rather than relying on humans to read and comply with written rules.

Who should care: General readers · AI governance · Policy · Privacy officers

IAPP · May 13, 2026 · International

The AI governance conversation is happening in the wrong room

A piece published through the IAPP argues that current AI governance discussions are taking place in forums or among stakeholders that exclude key voices, suggesting the existing deliberative spaces are misaligned with the breadth of interests at stake.

Who should care: AI governance · Lawyers · Administrators · General readers · Policy

IAPP · May 13, 2026 · International

Maryland enacts a first-of-its-kind surveillance pricing law, but there are loopholes

Maryland has passed what is being described as the first law of its kind targeting surveillance-based pricing, where companies use personal data to charge individuals different prices. The law contains notable loopholes that may limit how much it actually constrains the practice.

Who should care: Privacy officers · Cybersecurity · General readers · Policy

IAPP · May 13, 2026 · International

Amendments move Colorado AI Act's focus from risk to transparency

Proposed amendments to Colorado's AI Act would shift the law's regulatory emphasis away from risk-based obligations for developers and deployers toward transparency and disclosure requirements, representing a notable recalibration of how the state approaches AI governance.

Who should care: AI governance · Lawyers · Administrators · General readers · Policy

The Guardian — Privacy · May 11, 2026 · International

Palantir’s access to identifiable NHS England patient data is ‘dangerous’, MPs say

UK parliamentarians have raised alarms over NHS England granting Palantir and other contractors broad access to identifiable patient records — before pseudonymisation — as part of an AI platform development project. Internal NHS documents reportedly acknowledged the arrangement carries a risk of eroding public trust.

Who should care: Healthcare professionals · Privacy officers · Compliance · General readers · AI governance · Policy

FTC Consumer Protection · May 11, 2026 · US Federal

FTC Chairman Ferguson Advises Companies to Comply with the Take It Down Act

FTC Chairman Andrew Ferguson sent letters to more than a dozen major technology companies, including Amazon, Alphabet, and Apple, reminding them they must comply with the Take It Down Act by May 19. The law requires covered platforms to create a process for victims, including minors, to request removal of nonconsensual intimate images.

Who should care: General readers · Privacy officers · Policy

Information Commissioner's Office · May 11, 2026 · UK

Fine of nearly £1m issued against South Staffordshire Plc and South Staffordshire Water Plc following major cyber attack and data breach

The UK's Information Commissioner's Office has levied a fine of approximately £1 million against South Staffordshire Plc and its water utility subsidiary following a significant cyberattack that resulted in a personal data breach affecting customers.

Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance

Data Protection Commission · May 11, 2026 · EU / Ireland

ARC Conference

I don't have enough information to write an accurate briefing from this input. The headline and excerpt provide only a name ("ARC Conference") and an entity ("Data Protection Commission") with no factual detail about what happened, what was announced, or what was decided. To write a briefing that m

Who should care: General readers · Privacy officers · Policy

LINC CNIL · May 11, 2026 · EU / France

Smart glasses: what was old is new again?

Smart glasses: what was old is new again? LINC CNIL

Data Protection Commission · May 08, 2026 · EU / Ireland

Data Protection Commission Publishes Final Decision Following Inquiry into Permanent TSB

I need to work with limited information here — the excerpt is essentially just the headline repeated with no additional detail. I'll write based on what the headline reasonably implies: Ireland's DPC completed a formal inquiry into Permanent TSB and issued a final decision. ```json { "summary": "

Who should care: General readers · Privacy officers · Policy

EDPS · May 07, 2026 · EU

Safe and Ethical AI: a big European idea for the world

The European Union is using Europe Day on May 9 to reaffirm its position that AI development should be grounded in human rights, transparency, and ethical standards. The message frames Europe's regulatory approach as a model with global relevance.

Who should care: General readers · AI governance · Policy